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Abstract 

Let E/Q be an elliptic curve and p be a prime number, and let G be the Galois group of the extension of 
Q obtained by adjoining the coordinates of the p-torsion points on E. We determine all cases when the 
Galois cohomology group H 1 (G, E\p)) does not vanish, and investigate the analogous question for E\p l ] 
when i > 1. We include an application to the verification of certain cases of the Birch and Swinnerton- 
Dyer conjecture, and another application to the Grunwald-Wang problem for elliptic curves. 


1 Introduction 

Let E be an elliptic curve over Q and p a prime number. Denote by K the Galois extension of Q obtained 
by adjoining the coordinates of the p-torsion points on E and let G be the Galois group of K/Q. The 
Galois action on the p-torsion points E[p\ identifies G with a subgroup of GL(£’[p]) = GL 2 (F p ) via the 
representation p: Gal(Q/Q) —> GL(if[p]). A celebrated theorem of Serre [ST] shows that G is equal to 
the full group GL 2 (F p ) for all but finitely many primes p when the curve is fixed. 

We are interested in the vanishing of the Galois cohomology group H 1 (G, E[p]) ; see 22 or [TH] for 
the basic definitions of Galois cohomology. This specific cohomology group appears as an obstruction in 
various contexts. For instance, Kolyvagin’s work uses the vanishing of this group in the case G is equal 
to GL 2 (F p ) (see Proposition 9.1 in P3j). The following first theorem characterizes completely when this 
cohomology group does not vanish, answering a question at [15] . 

Theorem 1. Fix a prime p. Let E/Q be an elliptic curve, K = Q(£’[p]), and G the Galois group of 
K/Q. Then H 1 (G, E\p\) is trivial except in the following cases: 

• p = 3, there is a rational point of order 3 on E, and there are no other isogenies of degree 3 from 
E that are defined over Q. 

• p = 5 and the quadratic twist of E by D = 5 has a rational point of order 5, but no other isogenies 
of degree 5 defined over Q. 

• p = 11 and E is the curve labeled as 121c2 in Cremona’s tables w, given by the global minimal 
equation y 2 + x y = x 3 + x 2 — 3632 x + 82757. 

In each of these cases, H l (G,E[p \) hasp elements. 

Partial results on this question have appeared in various sources. For instance, Lemma 10 in 0 by 
Coates shows that iL 1 (G,S[p]) vanishes when E[p] is irreducible as a Galois module. Section 3 in [?j 
also treats related questions. 

The above result extends to elliptic curves E over more general number fields F if we assume that 
F n Q{pp) = Q, where Q(p p ) is the field generated by p-th roots of unity. Rather than a single elliptic 
curve for p > 5, one finds possibly infinitely many exceptions for p = 11 and p = 17, but only finitely 
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many further exceptions for each p > 17 and none for all p such that p = 1 (mod 3). See Theorem IIII for 
a precise statement. 

Next, we address the analogous question for E[p 1 } for i > 1, but assuming that p > 3. 

Theorem 2. Fix a prime p > 3. Let E/ Q be an elliptic curve, Ki = Q(A[p*]) the extension of Q 
obtained by adjoining the coordinates of all p l -torsion points, and Gi the Galois group of Ki/Q. Then 
ff 1 (G 2 , A[p 2 ]) is trivial if and only if H 1 (Gi, E\p l f) is trivial for all i ^ 2. This vanishing holds if and 
only if ( E,p ) is not among the following cases: 

• p = 5 or p = 7 and E contains a rational p-torsion point. 

• p = 5 and there is an isogeny <p: E —>■ E' of degree 5 defined over Q and the quadratic twist by 
D = 5 of E contains a rational 5-torsion point. 

• p = 5 and there is an isogeny ip: E —»• E’ of degree 5 defined over Q but none of degree 25 and the 
quadratic twist by D = 5 of E’ contains a rational 5-torsion point. 

• p = 5 and E admits an isogeny E —^ E' —> E" of degree 25 defined over Q and E' contains a 
rational 5-torsion point. 

• p = 11 and E is 121cl or 121c2. 

Again, we will also obtain some results that are valid over more general base fields F with F DQ(/x p ) = 
Q, and some that are valid for p = 3. See Section [6] 

This more general question has also been investigated before, and Cha has obtained results in this 
direction in [3]. He proved the vanishing of Ft 1 (Gi, E\p l \) when p > 3, the curve has semi-stable reduction 
at an unramified place above p, and E does not have a rational p-torsion point. He also describes when 
this cohomology group vanishes for p = 3 under his assumptions. The method of proof is similar. 

The results in Theorem [2] can be applied to the Grunwald-Wang problem for elliptic curves as for¬ 
mulated by Dvornicich and Zannier in [5]. In Proposition 1251 we give an example of an elliptic curve 
E/Q with a point P £ E( Q) divisible by m = 9 in E(Qg) for almost all primes i but not divisible by 
9 in E( Q). Previously, the only known examples [TO] were with m = 4. In Theorem [24l we also give a 
simplified proof of the result in 1201 that it is impossible to find such a point P when m = p 2 and p > 3. 

The paper is structured as follows. We begin with some background in Section [2j both establishing 
notation and reducing to cases where the Galois group G does not contain a nontrivial homothety. 
In Section [3] we prove a general form of Theorem [TJ Section [I] establishes a vanishing result for Ft 2 . In 
Section[5]we give an application to verifying cases of the Birch and Swinnerton-Dyer conjecture, correcting 
an oversight in [T3J - Our main results classifying the vanishing of H 1 (Gi, E[p 1 ]) are then discussed in 
Section[6j and some supplementary numerical computations for Ft 1 (G 2 , E[p 2 ]) are included in Section[7] 
Finally, in Section [5] we give the application to the Grunwald-Wang problem for elliptic curves. 
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2 Preliminaries and notation 

Throughout this paper E will be an elliptic curve defined over a number field F and p will be a prime 
number. We will denote by K = F(E[p\) the number field obtained by adjoining the coordinates of the 
p-torsion points to F. Let G be the Galois group of K/F. More generally, for * > 1 we let Ki = F(E[p l ]) 
and Gi = Gal (Ki/F). The faithful actions of Gi on E(p l ] give embeddings Gi c —^ Aut(Fl[p 1 ]) = GL 2 (Z/p l ), 
and so we may regard them as subgroups. 

We will also use the groups Hi = G&\(I\ i+ i/ Ki) and M, : = Gal(A'i//\). We note that, as Hi is the 
kernel of the map G^+i —> G,;, it is identified with a subgroup of 

ker(GL 2 (Z/p i+1 ) -> GL 2 (Z/p i )) “ Mat 2 (F p ), 
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where the conjugation action of Gi+i C GL 2 (Z/p z+1 ) is by the adjoint representation. Therefore, all 
elements in Hi have order p and commute with the elements of 1 inside Gi+\. 

In summary, we have the following situation: 


K i+ 1 



We will later use the inflation-restriction sequence 

0- ^H 1 (Gi, E\p>]) -^^H 1 (G i+1 , E\p>]) -^^H 1 (Hi,E\p>]) Gi - *H*(G u E]jP]) (1) 

which is valid for all 1 ^ j i. In inductive arguments, we will also use that the short exact sequence 

0- *-E\p] - *-E\p>] - ^E^- 1 } -^0 

gives a long exact sequence 

E(F) [pi- 1 ] -- H 1 (Gi, E[p ])-- H 1 (Gi, E[p >])- ^H 1 (G it E &~'}). (2) 

As mentioned in the introduction, these cohomology groups only start to be interesting when E[p] is 
reducible. The following argument for this is given in [3] as Theorem 7. 

Lemma 3. If G contains a non-trivial homothety, then H 1 [Gi, E[p 1 }) = 0. 


Proof. Let g be a non-trivial homothety. Since g is central, (g) is a normal subgroup in G. Consider the 
inflation-restriction sequence 

0-- H 1 (G/(g), E[p]^) - ^H 1 (G, E[pj) -- H 1 ((g), E]p]) 

The homothety g cannot have fixed points in E\p\, in particular E(F)\p] = 0. The left-hand side 
cohomology group in the above sequence is therefore trivial. The right-hand side is also trivial because 
(g) is of order coprime to p. 

We assume by induction that H 1 (Gi, E\p 1 ]) and H l (Gi,E[p\) are both trivial. By assumption, the 
restriction maps 

H^Gi+uEtf]) -“Hom(iZ i ,.E[p i ]) Gi 

H'(G i+l ,E\p}) - -H^HuElp]) 0 * “ Rom^,E[p}) Gi 

from m are both injective. Note that the target groups are actually equal because all elements in Hi 
have order p. Since Mi + \ and Hi commute, the action of Gi on Hi factors through G, so the target in 
both cases is Horn (Hi, E[p]) . 

The homothety g acts trivially on Hi and non-trivially on any non-zero point in E[p\. Therefore, 
there are no homomorphisms from Hi to E\p] which are fixed by g. It follows that H 1 (G^+i, E[p 1 ]) 
and H 1 (Gi+i, E\p\) are both trivial. The exact sequence fl5]l now implies that H 1 (Gj+i, E[p l+1 ]) is also 
trivial. □ 
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Lemma 4. Suppose p > 2. Assume that G does not contain a non-trivial homothety and FnQ(p p ) = Q. 
Then G is contained in a Borel subgroup. 


Proof. By the Weil pairing, the determinant of p is the Teichmiiller character u describing the action of 
Galois on the p-th roots of unity p p . The assumption F (~l Q(p p ) = Q implies that det: G — > F* must be 
surjective. 

Assume first that p > 3. We fix a basis of E[p\ and view G as a subgroup of GL 2 (F p ). By the 
classification of maximal subgroups of GL 2 (F p ), we have to show that the following cases can not occur: 
G is a subgroup of the normalizer of a split Cartan group, G is a subgroup of the normalizer of a non-split 
Cartan group, or G maps to an exceptional group A4, A 5 or S4 in PGL 2 (F p ). 

Suppose G is a subgroup of the group of diagonal and anti-diagonal matrices, which is the normalizer 
of a split Cartan subgroup. Suppose moreover that G is not a subgroup of the diagonal matrices. The 
square of ( ° c §) £ G is the homothety by be. Therefore, all anti-diagonal elements in G must be of the 
form (0 c q 1 ) ■ Multiplying this with a diagonal element (°) i n G then shows that all diagonal elements 
must have determinant 1. Hence the determinant would not be surjective for p > 3. 

Next, suppose that G is a subgroup of the normalizer of a non-split Cartan group. Since G contains 
no non-trivial homothety, the image of G in PGL 2 (F p ) is isomorphic to G. In other words, G must be a 
subgroup of a dihedral group of order 2 (jp + 1). No such group could have a surjective map onto F* if 
p > 3. 

Finally, assume that G is exceptional. As before, our hypothesis implies that G is isomorphic to a 
subgroup of A4, A 5 or S4. However the only case in which we could have a surjective map onto F* with 
p > 3 is when p = 5 and G is a cyclic group of order 4 in S4. However, as F 5 contains the fourth roots 
of unity /Z 4 , all such subgroups are diagonalizable in GL 2 (F 5 ). 

We now return to the case p = 3. By assumption, G is isomorphic to its image in PGL 2 (F p ), which 
is the full symmetric group on the four elements P 1 (Fa). Since the determinant is surjective, the image 
of G cannot be contained in the alternating group. Therefore it is not transitive on P 1 (F 3 ), and G is 
contained in a Borel subgroup. □ 

From now on we will suppose that p : E —> E' is an isogeny of degree p defined over F, and write 
E[<p\ for its kernel. The dual isogeny is denoted by <p: E’ —»• E. We will now also fix a basis of 
E\p] with the property that the first point belongs to E\<p\. In this basis, the Galois representation 
p: Gal(F/F) —> GL(F[p]) = GL 2 (F p ) now takes values in the Borel subgroup of upper triangular 
matrices. We will write %: Gal(F/F) —> F* for the character of the Galois group on E'[<p\. Then the 
character on E[p\ is wx _1 , where w is the Teichmiiller character introduced above. The representation 
now is of the form p = ( 1 * ). 

Corollary 5. Suppose p > 2. If FnQ(y, p ) = Q and the group H l (G,E\p\) is non-trivial, then E admits 
exactly one isogeny <p: E —> E' of degree p that is defined over F. 


Proof. By Lemma [3l we know that there is no non-trivial homothety in G. Then Lemma U implies that 
G is contained in a Borel subgroup. Hence there is a subgroup of order p in E[p\ fixed by the Galois 
group. If there were a second subgroup of order p fixed by the Galois group, then in a suitable basis of 
E[p] the group G would consist of diagonal matrices. It would follow that G has order coprime to p and 
therefore that the cohomology group is trivial. Therefore, there is a unique isogeny defined over F of 
degree p. □ 


3 Proof of Theorem |T] 

We begin by assuming that E is defined over a number field F such that F fl Q(p P ) = Q. 
Lemma 6. The cohomology group H 1 (G',E[ 2]) always vanishes. 
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Proof. The group GL/ 2 (F 2 ) is isomorphic to the symmetric group on 3 letters. For any cyclic subgroup 
of GL 2 (F 2 ) of order 2 generated by h , we may compute H 1 ((h), E[ 2]) as the quotient of the kernel of the 
norm Nq = 1 + h on E\ 2] modulo the image of h — 1. Because p = 2, this group is trivial. 

For a general subgroup G < GL 2 (F 2 ), let H be the intersection of G with the normal subgroup of order 
3. We have H 1 (H,E[ 2]) = 0 because the order of H is coprime to 2. We also have H 1 (G/H,E[2] H ) = 0 
because H is either of order 3 and only fixes 0 in E[ 2], or H is trivial and this group is H 1 ((h), E[ 2]) = 0. 
By the inflation-restriction sequence, we conclude that H 1 (G,E[ 2]) =0. □ 


Lemma 7. Let H < GL 2 (F p ) be the subgroup generated by h = (J j). We have an isomorphism, 

H^H^lp})^ F p , 

and the action of an element g = (0 “) in the normalizer N(H) of H on this cohomology group is 
multiplication by u~ 1 v 2 . 


Proof. The cohomology of the cyclic group H is computed to be 


H\H,E\p]) = 


ker(Ea=o ha ) _ ker (°) 


i(h-l) 


'0 n 

.0 0 ) 


= F p . 


The explicit isomorphism i: H 1 (H, E[p\) —► F p sends a cocycle f: H E[p] to the second coordinate of 
£(/i). Let now g = ( q “) be an element of N(H) with u, v £ F* . Then the action of g on £ £ H 1 ( H, E\p \) 
is as follows. 


(s*£)0) =g£(g x %) 
= 9t(h u ~ lv ) 


= g(h u ~ lv - 1 + ... + h + l)Z(h) 

= (S2)(“" 0 lv u -\,)(m) 

Here the terms denoted by * are unknown entries which do not alter the result that 

i(g*Z) =u~ 1 v 2 i(0. □ 


For the remainder of this section we will assume that p > 2 and E satisfies PI 1 (G, 
to show that we fall into one of the cases listed in the Theorem [T| 


E\p\) 0; we wish 


Lemma 8. Suppose p > 2. Then G satisfies H 1 (G, E[p\) ^ 0 if and only if p ^ 1 (mod 3) and there 

exists a basis of E[p\ such that G consists of all matrices of the form ( u 0 2 “) with v £ F p and w £ F p . 

, 2 >. 

In this case, the cohomology group is isomorphic to F p and the representation p is of the form ( X Q * ), 
where % 3 is the Teichmiiller characters. 


Proof. By Corollary [5l we may view G as a group of upper triangular matrices containing the subgroup 
H generated by element h = (J \) of order p. 

Since H is a normal subgroup of G, we can use the inflation-restriction sequence to show that 

H 1 (G, E\p]) -- H 1 (H, E\p]) G/H 

is an isomorphism because G/H is of order coprime to p. Because we assumed that H 1 (G, E(p\) is 
non-trivial, by Lemma 0 we must have that G/H acts trivially on H 1 (H, E[p\), that H 1 (G, E[p)) has 
precisely p elements, and that all elements in G must be of the form ( V J ™) with w £ F p and v £ F p . 

Recall that the character y is such that p = (“* 1 * ). We now deduce that y 2 = wx -1 and hence 
X 3 = w. Since we assumed F fl Q (p p ) = Q, the determinant s from G to F p must be surjective. As the 
determinant of the typical element in G is v 3 with v £ F p , we must conclude that either p = 3 or p ~ 2 
(mod 3), and that G is equal to the group of all matrices of the form (^ “). □ 
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Corollary 9. If p = 3, we have H 1 (G, E{3}) ^ 0 if and only if E has a 3-torsion point and no other 
isogenies defined over F. 


Proof. This can only occur if the group G is the group of matrices of the form (J “) of order 6 . This is 
precisely the case when E(F)[3] is of order 3 and no other isogenies are defined over F. □ 

Lemma 10. If p = 5, we have H 1 (G,E[ 5]) 0 if and only if the quadratic twist of E by D = 5 has a 

5-torsion point and no other isogenies defined over F. 


Proof. This happens precisely when we have 



Here w 2 is the quadratic character corresponding to the non-trivial extension F(\/5)/F contained in 
F(p, 5 ). Let E' be the quadratic twist of E by D = 5. Then we have the desired form of representation 
p if and only if the representation p f on [5] is now of the form (J * ). We conclude that this occurs if 
and only if JT'I’ (W) [5] has five points and E^ has no other isogenies of degree 5 defined over F. □ 


Theorem 11. Let E be an elliptic curve defined over a number field F with F D Q(/z p ) = Q. Let 
K = F[E[p\) and G = Gal(T/A'). Then H 1 (G, E[pf) = 0 except in the following cases: 

• p = 3, there is a rational 3-torsion point in E(F), and there are no other 3-isogenies from E defined 
over F. 

• p = 5 and the quadratic twist of E by D = 5 has a rational point of order 5, but no other isogenies 
of degree 5 defined over F. 

• p ^ 11, p = 2 (mod 3), there is a unique isogeny ip: E —» E' of degree p defined over F, its kernel 
E[<p\ acquires a rational point over F ■ Q(/r p ) + , and E\ip\ = pf (P+ 1 )/ 3 . 

There are only finitely many cases for each prime p with p > 17. 


Proof. The only remaining cases to prove are those where p > 5. As we may assume p = 2 (mod 3), one 
sees that 

p+i 

UJ 3 51 s 

0 WT 

This explains the condition in the cases p > 11 in the above list. 

The curve E and its unique isogeny <p of degree p defined over F represent a point on the modular 
curve Lo(p) defined over F. For p = 11 and p = 17, the curve Yq(p) is of genus 1; for all larger primes 
p = 2 (mod 3) it is of genus at least two. Therefore there are only finitely many Q-isomorphism classes 
of curves E/F with an isogeny of degree p defined over F. Only a single twist in each class can have p 
of the above shape. Hence there are only finitely many exceptions for p > 17. □ 

We specialize now to the field F = Q where the points on lo (p) are well-known. 

Lemma 12. If F = Q andp > 5, we have H 1 (G, E[pf) ^ 0 if and only if E is the curve labeled as 121c2 
in Cremona’s tables. 
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Proof. For all those p, there are only a finite number of Q-isomorphism classes of elliptic curves E with a 
p-isogeny defined over Q. Mazur’s theorem |16] shows that there are no rational points on Yq(p) except for 
three points on To ( 11 ) and two points on Yq (17). All of these five examples have no other automorphisms 
than ± 1 . Hence, all elliptic curves E/Q representing one of them are quadratic twists of each other. 

Let us first look at p = 11. The j-invariants of the three families are —121, —32768, and —24729001, 
and the representation p must now be of the form (“ * 7 ). We start with the last. The curve 121c2 is an 

example of an elliptic curve with j-invariant —24729001. Using SageMath [23j, we find a point P of order 
11 in E( Q(/zn)). Its ^-coordinate in the global minimal model given above is 11 </ 9 +11 </ 8 + 22 £ 7 + 22 <; 6 + 
22(f + 22 </ 4 + 11 £ 3 + Ilf 2 + 39, where f is a primitive 11-th root of unity. One finds that cr(P) = 5 P 
for the Galois element with a(Q = f 2 . Therefore the action of Galois on the group generated by P is 
given by w 4 . The isogeny with P in its kernel is defined over Q and it is the only isogeny on E defined 
over Q. Therefore the group G is precisely of the form required. Hence H 1 (G', E[p\) has p elements. No 
quadratic twist of E could have the same property. 

With similar computation one finds that the group G for the curve 121bl with j-invariant —32768 is 
of the form * 3 ) and for the curve 121cl with j-invariant —121 it is (“ J 4 ). No quadratic twist of 
these curves could have the required form for G. 

For p = 17, the representation p must now be of the form (“ Jb ). In particular, for any prime I 7 ^ 11 
of good reduction for E, the Frobenius element is sent to a matrix of the form (^ * X1 ). We conclude that 
we must have + 1 111 = at (mod p), where at is the trace of Frobenius. This gives an easy criterion to 
rule out specific curves. 

There are two j-invariants of elliptic curves that admit a 17-isogeny over Q: —297756989/2 and 
—882216989/131072. In fact, these values were computed by Velu and published on page 80 of PQ. We 
pick a curve E for each of these j-invariants. The curves 14450pl and 14450nl are examples. Now for 
both curves, it is easy to show that ±3 6 ± 3 11 ^ 03 (mod 17) for any choice of the signs as <23 = ±2. 
Therefore no quadratic twist of E will satisfy the congruence that we need. Thus H 1 (G, E\p\) — 0 for all 
curves with a degree-17 isogeny. Similar computations were done by Greenberg in Remark 2.1.2 in m- 

□ 


This concludes the proof of Theorem Q] 


4 Vanishing of the second cohomology 

We continue to assume that E is defined over a number field F such that F D Q(/%>) = Q. 

Lemma 13. Let p be a prime. Then H 2 (G, E[p\) =0 except if p > 2, E admits a p-isogeny ip: E — » E' 
and no other p-isogenies over F, and E'[tp] contains an F-rational p-torsion point. If this cohomology 
group is non-zero then it contains p elements. 

We could also write the condition in the lemma as either that E\ip\ = p p or that \ is trivial. 

Proof. As before, only the cases when p divides the order of G are of interest. 

We again discuss the case p = 2 separately. A Sylow subgroup of G is a cyclic group of order 2 
generated by h, and the restriction H 2 (G,E[p\) — > H 2 ((h), E[p\) is an inclusion. However, H 2 ((h), E\p\) 
can be computed as the Tate cohomology group H° ((h), E\p\), which is zero. 

For p > 2, we have to deal with the cases when G contains SL(U[p]) and when G is contained in a 
Borel subgroup. 

In the first case, G is actually the full group GL(U[p]) as the Weil pairing forces the determinant to 
be surjective. If Z is the center of G , then H l (Z, E\p\) = 0 for all i ^ 0. The Hochschild-Serre spectral 
sequence implies that H l (G,E[p\) = 0 for all i ^ 0. 

Now we may assume that G is contained in the Borel subgroup of upper-triangular matrices. If there 
is more that one isomorphism class of p-isogeny leaving E which is defined over F , then G is of order 
coprime to p and hence H 2 (G , E\p\) = 0. Therefore, we may assume that G contains the unique p-Sylow 
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H generated by h = (J }). Since H is normal and G/H is of order coprime to p, the restriction 

H 2 (G,E\p])^H 2 (H,E\p]) G/H 

is an isomorphism. 

Fix an injective homomorphism ip: H —► Q/Z. Let 5: H X (H, Q/Z) —> 7J 2 (iL, Z) be the connecting 
homomorphism. Then we have an isomorphism H°(H,E\p]) —> H 2 (H, F[p]) given by sending a point 
P G E\p\ to the cup product 5ip U P. For p > 2, the Tate cohomology group H°(H, E\p\ ) is equal to the 
usual cohomology group H°(H, E[pj) = E[p\, which has p elements. 

Let g = (o v) G G. On the one hand, it acts on P by multiplication by u. On the other hand, it acts 
on ip by multiplication by u~ 1 v because 

(g*ip)(h) = gip(g~ 1 hg) = ip(h u * v ) = u~ 1 vip{h). 

It follows that g acts on the generator of H 2 (H, E[p\) by multiplication by uu~ 1 v = v. Unless all such 
g G G have v = 1, we conclude that the second cohomology group vanishes. Otherwise it has p elements, 
and this occurs if and only if E'[(p\ contains a rational p-torsion point. □ 

5 Application to the conjecture of Birch and Swinnerton-Dyer 
and jd-descent 

The vanishing of the Galois cohomology group we consider is used when trying to extend Kolyvagin’s 
results to find a sharper bound on the Birch and Swinnerton-Dyer conjecture for elliptic curves of analytic 
rank at most 1. This was the original motivation in Clia’s work m ■ In (T3] . the authors attempt to extend 
Cha’s results, but there is a mistake in the proof of their Lemma 5.4 and consequently their Theorem 3.5 
is not correct. The latter is also copied as Theorem 5.3 in HI. Using our results above, we can now state 
and prove a corrected version of Theorem 3.5 in [T3]. We refer to the original paper for the notations. 

Theorem 14. Let F/Q be an elliptic curve of analytic rank at most 1. Let p be an odd prime. Let 
F a quadratic imaginary field satisfying the Heegner hypothesis and suppose p does not ramify in F/Q. 
Suppose that (E,p) does not appear in the list of Theorem [7] and that E is not isogenous to an elliptic 
curve over Q such that the dual isogeny contains a rational p-torsion point. Then the p-adic valuation of 
the order of the Tate-Shafarevich group is bounded by twice the index of the Heegner point. 


Proof. In their proof, only the vanishing of H 1 (G, E[p\) and H 2 (G, F[p]) are needed for the argument. 
Under our assumptions they both vanish by Theorem [l] and Lemma 1131 One has also to note that, as 
pointed out in m, the assumption in their theorem that E does not admit complex multiplication is not 
used in the proof. Finally, the paper m needs that F is not included in K = Q(F[p]) to conclude that 
lP(Gal(F(F[p])/F), F[p]) also vanishes for i = 1 and 2. This is guaranteed by the Heegner hypothesis 
and the assumption that p does not ramify in F, as F and K then have disjoint sets of ramified primes. □ 

The following is a short-cut in the usual p-descent for E =121c2 and p = 11. It is not a new result as 
it appears already in US! as Example 7.4. However it illustrates that the non-trivial class in H 1 ( G , E[p\) 
can be of use. 

Proposition 15. The Tate-Shafarevich group of the curve 121c2 does not contain any non-trivial ele¬ 
ments of order 11. The full Birch and Swinnerton-Dyer conjecture holds for this curve. 


Proof. Set p = 11. Let p: E —> E' be the p-isogeny defined over Q. We saw before that E[p\ = F p (4) 
and E'[p\ = F p (7) where F p (k) is the 1-dimensional F p -vector space with the Galois group acting by the 
character ui k . 

Let F be the maximal extension of Q which is unramified at all finite places £ p. Write Q = 
Gal(F/Q) and H = Gal(F/Q((j)) where ( is a primitive p-th root of 1. Let T = Q/H. Since |T| is 


coprime to p, we have an isomorphism H 1 {Q 1 E[tp\) = H 1 ('H, .E[p]) r . Now Dirichlet’s unit theorem can 
be used to compute 

4 

H 1 (H, F p (l)) = H 1 (H, fip) = F p (l) ® F p (2 i) 

i =0 

as a F p [r]-module; see for instance Corollary 8.6.12 (or 8.7.3 in the second edition) in [TO]. Since 
H 1 (H,¥ p (k)) = H 1 (H,F p (l))(k — 1), the group H 1 (Q, F p (/c)) is a sum of copies of F p corresponding to 
the copies of F p (l — k) in H 1 ("H, F p (l)). We deduce that H 1 (fy, E[ip\) is trivial and that H 1 (Q, E'[ip\) is 
1 -dimensional. 

Since K/Q is only ramified at p , we have an inflation map H 1 (G, E'[@\) — ► H 1 (Q , E'[tp]) . By Theo¬ 
rem IT] and the above, this is now an isomorphism and our explicit cocycle £ can be viewed as a generator 
for H 1 (Q,E'[p\). 

The tp-Selmer group Sel v is defined to be the kernel of the map 

H 1 (g,E , [0\)^H 1 (Q p ,E , )[0]. 

An explicit local computation shows that ip: E'{ Q p ) —> E(Q P ) is surjective. Therefore H 1 (Q p , E'} [<p] = 
H 1 {Q p , E'[p]) . Since K/Q is totally ramified at p, the decomposition group of K/Q at the unique place 
above p in K is equal to G. Therefore £ also inflates to a non-trivial element in H 1 (Q p , E'[ipf) . It follows 
that the generator of H 1 (Q, E'[p/j does not lie in the Selmer group. Therefore SeP is trivial. 

Since H 1 (Q, E[ip]) = 0, the <p-Selmer group SeF is trivial. The usual exact sequence 

Sel v -^ SeF (E/Q)-- SeF 

shows now that the p-Selmer group Sel p (E/Q) is trivial. Therefore the rank of E is zero and the p-primary 
part of the Tate-Shafarevich group III(i?/Q) is trivial. 

As explained in Theorem 8.5 in [ 12 : the only prime at which one has to check the Birch and 
Swinnerton-Dyer conjecture after the Heegner point computations done there is p = 11. Therefore, 
this completes the proof of the conjecture for this specific elliptic curve. □ 

The main result of ’T7] (based on [18] and 0) by Miller and his collaborators states that the Birch and 
Swinnerton-Dyer conjecture holds for all elliptic curves of conductor at most 5000 and analytic rank at 
most 1 . As a consequence of the error in [TO], the verification for some curves in this list is not complete. 
The following is a description how we performed the necessary computations to fill in the gaps for all 
these curves. See also m for the correction of the corresponding bug in SageMath. 

From the change in Theorem [14] it follows that only curves E contained in the list of Theorem [l] 
could have been affected when verifying the p-part of the conjecture. The case 121c2 was verified in 
Proposition [TO] The exceptional cases with p = 3 are already dealt with in Theorem 9.1 in ]T8], as 
they were already considered exceptional cases there. That only leaves the curves with non-vanishing 
H 1 (G,E[ 5]). For the following list of curves, we had to perform a 5-descent to verify the conjecture: 
50a3, 50a4, 75a2, 150b3, 150b4,175c2, 275bl, 325d2, 550bl, 550f3, 775cl, 950al, 1050d2, 1425bl, 1450al, 
1650bl, 1650b2,1650c2,1650d2,1950b2,1975dl, 2175f2, 2350e2, 2550f2, 2850al, 2850a2, 2850g2, 2950al, 
3075dl, 3075g2, 3325cl, 3550dl, 3850k2, 3950al, 4350al, 4350a2, 4425cl, 4450al, 4450f2, 4650el, 4650k2, 
4650m2. The methods in [TO] are sufficient in all these cases. If the rank is 1, then even the weaker bound 
in their Corollary 7.3 is enough. Otherwise, if the rank is 0, the Selmer groups for <p and (p are trivial as 
one finds quickly by looking at a few local conditions. 

6 Results for i > 1 

We now turn to the question of finding all cases of elliptic curves E/F and primes p such that the group 
H 1 (Gi, E[p 1 ]) does not vanish for some i > 1. We continue to assume that F 0 Q(p p ) = Q and we will 
assume now that p > 2 . 

By Lemma[5]and LemmaS] we know that all these groups vanish unless there is an isogeny tp\ E —>■ E' 
defined over F. Therefore, we may continue to assume the existence of <p and that the group G is contained 
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in the Borel subgroup of upper triangular matrices. This fixes (up to scalar) the first basis element of 
E[p\ and we still have some flexibility about the second; if there is a second subgroup of E\p\ fixed by 
the Galois group, we will choose the second basis element in there. Unlike in the case i = 1, we may not 
yet assume that p divides the order of G. 

In what follows we will write expressions like G = (J *). By this we mean that G is equal to the 

group of all matrices of this form in GL 2 (F p ), so * on the diagonal can take any non-zero value and * in 

the top right corner can be any value in F p . 

Let M be the additive group of 2 x 2-matrices with coefficients in F p . Then G ^ GL 2 (F p ) acts on M by 
conjugation. We would like to determine Homc;(Af, -E[p]). We do so by computing first Home (Af, E[tp\) 
and Homo (M, E' [fi \). 

Lemma 16. Suppose first p > 3. The group Home (Af, E [</?]) is trivial except in the following cases. 

• If G = (o 2) in a suitable basis of E\p], then Home (Af, E[ip\) has dimension 2 over¥ p . 

• If G = (o i) in a suitable basis of E[p\, this group has dimension 1. 

• f/ G = (J * ), this group has dimension 1. 

• I u £ F p , w £ F p }, this group has dimension 1. 

If p = 3, the list is the same with one modification to the second and to the last case above. 

• //G=(qi) in a suitable basis of E[ 3], this group has dimension 2. 


Proof. If /: M —> E[tp\ is fixed by g £ G, then f(m) = g ■ f(g~ 1 mg) for all to £ Af. Let a, f3, 7 , and S 
be the images in E[ip\ under / of (Jo), (00)’ (io)> an d (01) respectively. Then the above equation 
for to being one of the these four matrices yields four equations that have to hold for all g = ( q ™) € G: 


a = u ■ (a + u~ 1 w ft) 
ft = u- ( u~ 1 v ft) 

7 = u ■ (— v _1 w a — u~ 1 v~ 1 w 2 j3 + uv~ x 7 + v~ 1 w S) 
S = u- (5 — u^ 1 w fi) 


From these equations, we deduce the following: 


/ is fixed by (J {) 
/ is fixed by (J °) for some v 1 
/ is fixed by ((j ?) for some u ^ ±1 
/ is fixed by ("g 1 1 ) 


/3 = 0 and a = S 

^ = 7 = 0 

a = 7 = S = 0 
a = 5 = 0 


(3) 


Assume first that G is contained in (J l)- Since the determinant must be surjective, G is either (J l) 
or (J 2), after choosing a suitable second basis element for E[p\. In both cases, the above allows us to 
verify the statements in the lemma. The case when G is contained in (J 1 ) is very similar, except that 
when p = 3, in which case we are in the group of matrices with v = u 2 and we can only apply the fourth 
equation instead of the third. 

Assume now that G contains an element (0 with » / 1 and one with tt / 1. Then /3 = 0 by the 
second equation in ©. From the last two equations, we deduce that a = S = 0. Now the equations m 
simplify to one equation (1 — u 2 v 1 )q = 0. Therefore, if G is contained in the group of matrices with 
v = u 2 , then the dimension of Home (M, E [</?]) is 1 and p > 3 as otherwise all g £ G have v = 1, otherwise 
the space is trivial. □ 

Recall that E'\0\ is the kernel of the dual isogeny. 
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Lemma 17. Suppose p > 2. The group Horn g{M,E'[lp\) is trivial except in the following cases. If G 
is contained in (J *) or i/G = (J*) or j/G = K ” 2 J) | v € F* } in a suitable basis for E[p \, then 
Horn g{M, E'[0\} has dimension 1. J/G= ( q^) in a suitable basis of E[p\, then it has dimension 2. 


Proof. This is analogous to the proof of the previous lemma. The equations ([3]) become equations where 
the u at the start of the right hand side of each equation is replaced by a v. This new set of equations 
can be rewritten as follows. 

(1 — v)a = u~ 1 vw ft 
(1 — u~ 1 v 2 )ft = 0 

„ (4) 

(1 — u) 7 = w(d — a) — u 1 w 2 /3 

(1 — v)S = - b _1 dw /? 

From here, the computations are again straightforward for the cases when G is contained in (JJ) or 
(o *) • If G is contained in the group {(" 2 ™) | v € F*, w £ F p }, it is either equal to this group, in which 
case the cohomology group in question is trivial, or it is equal to a subgroup of order p — 1. In the latter 
case, we may change the choice of basis of E[p] to get G to be equal to {('’ 2 Jj) | v £ F* }, in which case 
a = 7 = 5 = 0, but ft is free. In all other cases it is trivial. □ 

The exact sequence 

0-s-Home(M, E[ip\) -s-Home(M, E[p\) —^Hom g(M, E'[<p\ ) (5) 

connects the results from the previous two lemmas. 

Proposition 18. If p > 3, the group Horn g\M, E[pf) vanishes except when, for some choice of basis of 
E[p], it is one of the following subgroups. 


G 

= (iS) 

= (:?) 

= (5:) 


= ( v 2 0 ) 
VO vJ 

dim Fp Hom G (M, E\p}) 

3 

3 

2 

l 

l 


If p = 3, the group Hom^M, E[p\j vanishes except when, for some choice of basis of E[p], it is one of 
the following subgroups. 


G 

= (iS) 

= (:?) 

= (5:) 

= (n) 

dim F3 Homc(M, E [3]) 

3 

4 

2 

i 


Here we have chosen a suitable second basis element in E[p] as in the previous lemmas. Of course, 
the first two cases are in fact the same when the basis elements are swapped. 

Proof. If Horn g(M, £ ,/ [<£]) = 0, then the exact sequence © reduces this to Lemma 11771 Otherwise, we 
have to check if the homomorpliisms /: M —> E'[(p} lift to homomorphisms e: M —> E[p] that are G- 
equivariant. In the following four cases, they all lift indeed. We will just give the explicit map which form 
a basis of Hom^M, E\pf) modulo the image from Hom^M, E[ip]). One can verify without difficult that 
they are G-equivariant. 


G 

= (S2) 

= (35) 

= (5:) 

= (^2) 

e(“S) 

(b 

(°) and ( 0 ) 

(5) 

m 


There is only the case G = (o j) left to treat. The generator of Homc(M, E'[ip}) is given by /(“ b d ) = 
a + d. We will show that / does not lift to a map e: M —> E\p\. Denote by (“) the image of (J {,) under 
such an e and by ( q ) the image of (gj). Then we must have for all u ^ 1 and w in F p that 

(^) = (oY)e(r» = (SY)(^) = (r)- 
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Hence /3 = 0. Again for all u and w, we should have that 

(?) = (KT)e(j“- 0 1 -) = (“”)(?) = (% +,u ). 

However, this cannot hold for all choices no matter what a is. □ 

Definition. Let E/F be an elliptic curve. We will say that G; is greatest possible if it consists of all the 
matrices in GL 2 (Z/p*Z) that reduce to a matrix in G modulo p. Equivalently, Mi is the kernel of the 
map GL 2 (Z/p l ) GL 2 (F p ). 

We will show that if p > 2 and i > 1, then Gi is greatest possible if and only if G 2 is greatest possible: 
Since Gi —> Gi -1 is surjective, by induction it suffices to prove that the kernel Hi -1 contains all matrices 
of the form 1 + p l_1 A e GL 2 (Z/p*). If G 2 is greatest possible, then for any A € M 2 ( F p ) there exists an 
element g £ Gi whose image in GL 2 (Z/p 2 ) is 1 +pA. Then g v has image (1 + p l ~ 1 A) in GL 2 (Z/p*) by 
taking binomial expansions, and so Gi contains all of Hi- 1 . 

Proposition 19. Let p > 2 be a prime and let E/F be an elliptic curve. Suppose G lies in the Borel 
subgroup of upper triangular matrices and that G 2 is greatest possible. If G is not among the exceptional 
cases in Theorem [7] or in Proposition 1 1 <S’L then H l (Gi,E[p^/) = 0 for all i f? j f? 1. 

Proof. The short exact sequence © implies that if H 1 (Gj+i, .Efp- 5-1 ]) and H 1 (G i+ i,E[p\) are zero, then 
so is H 1 {Gi+\,E\pi\). By induction on j. it suffices to prove the proposition in the case j = 1. 

For i = 1, the statement follows from Theorem [L] We assume now that it holds for i fi l. By 
assumption M i+ 1 is isomorphic to the group (1 +pMat 2 (Z/p 1 )) C GL 2 (Z/p I+1 ) and Hi is isomorphic to 
the group M of all matrices with coefficients in F p . Using Proposition fl 8 l we find 

H^Mi+uElp}) 0 = Horn G (M i+1 , E]p\) “ Horn G (M,E\p]) = 0 

because all elements in the kernel of the map Mj + 1 —> M are p’th powers. (Note that this requires p > 2.) 
Now considering the inflation-restriction sequence 

0- ^H 1 (G, E[p\) -- H 1 (Gj+r, E\p\) - ^H 1 (. M i+1 , E{p}f ( 6 ) 

yields that H 1 (Gj+i, E\p\) =0. □ 

Lemma 20. Let p > 2 be a prime and E/F an elliptic curve such that G 2 is greatest possible. If G is 
among the exceptional cases in Theorem]]] or in Proposition]]]] then H 1 (Gi, E[p l f) ^ 0 for all if? 2. 


Proof. We claim that the sequence © is part of a short exact sequence. The next term in the sequence 
is H 2 (G,E[p\), and so it suffices to show that the map H 1 {M i+ i, E[p]) G H 2 (G,E[p ]) is zero. By 
Lemma m the target group is trivial unless G = ( q ^ ). Ifp>3 and G = ((j j), then the source group 
H 1 (M i+ i, E[p]) G vanishes. If p = 3 and G = (jj), the source is cyclic and generated by a cocycle 

£: Mj + i —> i£[3] such that (“^) i-p (°g 3 )- The image of £ in H 2 (G, E[p\) is zero because the formula 

(jJ)o (»<f) lifts it to a cocycle Gj+i —> £[3]. 

Therefore, the dimension of lL 1 (Gi+i, E[p\) is the sum of the dimensions of the two groups surrounding 
it in the sequence <[ 6 |). In all cases, this dimension is strictly larger than the dimension of the group of 
p-torsion points of E defined over F. 

Now we turn to sequence m with * ^ 2. In all cases, the dimension of H 1 (Gi, E\pf] is strictly larger 
than the dimension of E(F)\p l ~ 1 ]/pE(F)\p l ] (which is at most 1 because E(F)[p l ~ 1 ] must be cyclic by 
the assumption on F). We conclude that H 1 (Gi, E[p 1 ]) is non-trivial. □ 

So far we have been able to treat all cases in which Gi is greatest possible and F fl Q(p P ) = Q. We 

will now restrict our attention to F = Q and p > 3. Luckily, for the large majority of elliptic curves 
over Q the groups Gi are indeed greatest possible. The following is a summary of the results in m and 
in dj. 
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Theorem 21. Let p > 3 and i > 1. Let E/Q be an elliptic curve with an isogeny of degree p defined over 
Q. Then Gt is greatest possible except in two cases: 

• when p = 7 and the curve is the quadratic twist of a curve of conductor 49, or 

• when p = 5 and there is an isogeny if: E —7 E" of degree 25 defined over Q. 


We will now treat the two exceptional cases, starting with p = 5. 


Lemma 22. Let E/Q be an elliptic curve and suppose there is an cyclic isogeny if: E —» E' E" of 
degree p 2 = 25 defined over Q. Then H 1 (G 2 , A[p 2 ]) = 0 if and only if H 1 (Gi, E[p l f) = 0 for all i > 1. 
This vanishing holds except if G = (J *), */ G = (oi)> or if E appears in Theorem Q] as an exception. 


For instance, it is non-vanishing if E admits a rational 5-torsion point or if E' admits a rational 
5-torsion point. The curves lla3 and lla2 are examples of these two situations where H 1 (G, E[p\) = 0, 
yet H 1 (Gi, E\p l \) 7 0 for all* > 1 because there are two 5-isogenies lla3 —> llal —> lla2 with only lla3 
and llal having a rational 5-torsion point. The cohomology group H 1 (G 2 , E[25]) is also non-trivial for 
llal by Proposition [191 


Proof. Note that there are no elliptic curves with rational points of order 25 and there are no cyclic 
isogenies over Q of degree p 3 = 125. Greenberg shows in Theorem 2 in m that the index of G 2 in 
GL2(Z/25) is divisible by 5 but not 25. Hence the group G 2 can be identified with a subgroup of the 
upper triangular matrices modulo p 2 , but the top left entry is not constant 1 modulo p 2 and the top right 
corner is not constant zero modulo p. Since the index is only divisible by 5 once, the group G 2 consists 
of all the upper triangular matrices that reduce to an element of G. 

We wish to use the same strategy as in the proof of Proposition [TUI but we have to show that G- 
fixed part of H 1 (M 2 , E\p\) is still zero despite M 2 7 M. This time M 2 can be identified with upper 
triangular matrices modulo p and the computations are slightly easier. One finds that HomG(Af2,£[(/3]) 
has dimension 2 if G = ( 0 *) and 0 in all other cases. Similarly, the dimension of Home (M 2 , E'[7p\) is 
equal to2ifG = ( 01 ) and zero otherwise. (Alternatively, it is not too hard to show by direct calculation 
that the dimension of Home (M 2 , E[p]) is 2 ifG = ( 0 *), lifG=(oi), and 0 otherwise.) 

Hence if we assume that neither G = ( 01 ) nor G = (J *) nor G = | (™) v £ F* , w € F p j, then 
H 1 (Gj, E\p 1 ]) = 0 for all i ^ 1 with the same proof as in Proposition [T9] 

If G = ( J *), then one can show as in Lemma[2n]that H 1 (Gi,E\p 1 ]) is non-zero for all i > 1. Similarly 
for G = 


{( v ov) | veF* : weW p y 


Finally if G = (0 *); then one may compute H 1 (G2, E[p 2 } ) directly: the group G2 consists of all 
upper triangular matrices modulo p 2 whose lower right entry is congruent to 1 modulo p. Let H be the 
subgroup generated by (J (). Then the method used in the proof of Theorem [T] shows that the subgroup 
of H 1 (Ff, E\p 2 ] ) fixed by the action of G2/H is trivial. However H 1 (G 2 /M, E[p 2 ] H ^ = TLfpTL implies then 
that H 1 (G-?, E[p 2 ]^ = TLIph where an explicit isomorphism sends a cocycle £ to the first coordinate of 
*((& i+p)) in pZ/p 2 Z. From the exact sequence ([2]), one deduces that H 1 (G 2 , E[p\) is non-trivial and 
again this implies that all H l (Gi, E\p l fj are non-zero for i > 1. □ 


Lemma 23. Let E /Q be a quadratic twist of a curve of conductor 49 and letp = 7. Then H 1 (Gi, E[p l ]J = 
0 for all i ^ 1 . 


Proof. Assume first that E is one of the curves of conductor 49. By assumption E has complex multi¬ 
plication by O, where O is either Z[v^—7] or the ring of integers in Q(-y/—7). Since Q(\/—7) C K , the 
subgroup Gal(A7Q(v / ~7)) < G acts by G-linear endomorphisms on E[7 1 ]. By scaling with the period, 
we may choose points p and y/—7 ■ p as a basis for E[ 7 1 ]. Any lift of these forms a Z 7 -basis of the Tate 
module T 7 A. The endomorphism a + b\J~^7 with a, b £ Q D Z 7 acts via ( _ a 7b „) on Tj(E). 
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The Frobenius element Fr^ £ GL(TtE) for l = 347 lias trace an = 4 for all four curves of conductor 49. 
Since i splits in Q(\/—7), the Frobenius Fr^ in Gl^Zy) is a matrix of the above shape with trace 4 and 
determinant 347. We find that it is congruent to (g °) modulo 7. Since G contains now the homotheties 
by 2 and 4, the result follows from Lemma [3] 

Let now £ be a quadratic twist of a curve of conductor 49. Then it is the quadratic twist of one 
of them by an integer D coprime to 7. The above homotheties are multiplied by a non-zero scalar and 
hence Lemma [3] also implies the result for E. □ 

Proof of Theorem [|| We combine the results from Proposition HTfl Lemma [20l Lemma [22] and Lemma l23l 
From these we conclude immediately that H 1 (Gi, E[p l \) = 0 if and only if H 1 (G 2 , E[p 2 )) = 0. 

We are now left with making the list in Theorem [2] match with the non-vanishing cases. We start by 
verifying that the cohomology groups are non-vanishing in each of the five special cases in the theorem. 

• First, if E contains a rational point of order p , then G = (J 2), G = (0 ?), or G = (J *)• In all 
these cases, the cohomology groups in question do not vanish by Lemma [221 and Lemma \7I\ 

• In the second point in the list of Theorem EJ p = 5 and the quadratic twist by D = 5 of E has a 

rational 5-torsion point. Then G is contained in { ( *) | v £ F* }. If G is equal to that group, 

then Theorem[l]and Lemma EU1 or Lemma [TZ1 imply the non-vanishing of H 1 (G 2 , E[p 2 f). Otherwise 
we may choose the basis of E[p] so that G is contained in the diagonal matrices of this form, in 
which case Lemma EHl proves the assertion. 

• In the third point, p = 5 and the quadratic twist by D = 5 of E' has a rational 5-torsion point. 
Then G is contained in { ( g *2 ) | u £ F* }. There is no isogeny of degree 25 defined over Q leaving 
from E, hence G 2 is greatest possible; therefore Lemma EH1 proves the desired non-vanishing. 

• If we are in the situation of the fourth point in Theorem EJ we are in the situation of Lemma ES] 
and G = ( 5 I). Therefore H 1 (G 2 , E[p 2 }) ^ 0. 

• In the final point, if p = 11 and E is 121c2, then Theorem Q] and Lemma l20l shows the desired 

non-vanishing. If the curve is 121cl instead, then G = {(q ) | u £ F* } and Lemma EU1 treats 

this case too. 

Next, we have to check that every case when the group H 1 (G 2 , E[p 2 ]) is non-trivial is among the 
exceptional cases of Theorem E] above. 

Let us assume first that G '2 is greatest possible and consider the cases in Lemma [20] If G = (g °) or 
G = (g *), then E has a rational p-torsion point. By Mazur’s Theorem on the torsion point on elliptic 
curves over Q, we know that this can only occur if p = 5 or p = 7 and we fall under the first point in 
the list of Theorem El If (E, p) appears as an exception in Theorem [TJ then either p = 5 and we are in 
the situation of the second point, or p = 11 and we are in the last point on the list. If G is the group of 
all matrices of the form 0 ), then the quadratic twist by D = 5 has a rational 5-torsion point and we 
are in the situation of the second point. Finally, assume G is contained in the group {( o„*0 |«eF p *}. 
Then p = 2 (mod 3). If p = 5, then the quadratic twist by D = 5 of E' has a rational 5-torsion point 
and we are in the third case. If p ^ 11, then the proof that there is only one curve, namely 121cl, is very 
analogous to Lemma [12] 

Finally, we consider the cases in Lemma E3 If G = (J *), then E has a rational 5-torsion point and 
we are in the first point in the list. If G = (q J), then E' admits a rational 5-torsion point, which is the 
fourth point on the list. If (E,p) appear as exceptions in Theorem [T[ then we fall into the second point 
on the list. □ 


7 Numerical computations 

We used Magma [2] to perform, for small primes p , the numerical computation of our cohomology group 
iL 1 (G 2 , V 2 ) for various subgroup G 2 ^ GL 2 (Z/p 2 ), where V 2 is the natural rank 2 module over Z/p 2 on 
which G 2 acts. We restricted our attention to groups with surjective determinants and we only considered 
groups up to conjugation in GL 2 (Z/p 2 ). 

We will continue to write M 2 for the kernel of reduction G 2 —> GL 2 (F p ) and G for its image. 
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7.1 p = 2 

For the prime p = 2, the groups .ff 1 (G 2 ,I / 2 ) are non-zero for 36 conjugacy classes of subgroup G 2 < 

GL 2 (Z/ 4 ) with surjective determinant. The possible cohomology groups are (Z/2) fc for 0 ^ k ^ 6 and 
Z/4. Non-trivial cohomology groups appear for all dimensions 1 ^ d ^ 4 of M 2 . 


7.2 p = 3 

There are 41 groups G 2 with non-vanishing H l (G 2 ,V 2 ) ■ For thirteen of them the cohomology group is 
Z/3 © Z/3, for one it is Z/3 © Z/3 © Z/3 and for all others it is just Z/3. In all non-vanishing cases the 
image G ^ GL 2 (F 3 ) of reduction has either non-trivial H°(G,V) or non-trivial H 2 (G,V ), where V is 
the 2-dimensional vector space over F 3 with its natural action by G ^ GL 2 (F 3 ). In other words, these 
numerical computations show that if the group M 1 (G 2 , £[9]) is non-trivial for an elliptic curve E/Q, 
there is an isogeny ip: E —»• E' defined over Q of degree 3 such that either <p or its dual <p has a rational 
3-torsion point in its kernel. 

The maximal order of the cohomology group appears for the group G 2 consisting of all matrices in 
GL 2 (Z/9) with reduction (J §) or (q_?i) modulo 3. 


7.3 p = 5 

There are 39 groups G 2 with non-vanishing H 1 (G 2 1 Vf). For two of them, the group is Z/5 © Z/5, for 
one it is Z/25 and for all others it is Z/5. If we restrict to those groups for which M 2 has dimension 4, 
then there are five cases as found in Section [ 6 ] 

(5:) 

20 

Z/5 

This determines what the non-vanishing cohomology groups can be for this specific prime. 


G 

( V 2 0 ) 

Vo V ) 

(5!) 

/ U * \ 

VO u 2 ) 

(v 2 *\ 

Vo V ) 

\G\ 

4 

4 

20 

20 

£ 1 (G 2 ,F 2 ) 

Z/5 

Z/5 © Z/5 

Z/5 

Z/5 


7.4 p = 7 

Here we restricted our attention to the subgroups G 2 for which M 2 has dimension 4. Then, as previously 
found, there are only two cases. The group G can be of the form (J °) or (J *). In the first case the 
cohomology group H 1 {G 2 , V 2 ) is Z/7 © Z/7; in the latter it is Z/7. 


8 Applications to local and global divisibility of rational points 

The cohomology groups that we have discussed in this paper also appear in the analogue of the Grunwald- 
Wang problem for elliptic curves. This question was raised by Dvornicich and Zannier in [9j. 

Grunwald-Wang problem for elliptic curves. Let E/Q be an elliptic curve, P € E{ Q), and m > 1. If P 
is divisible by m in E(Qe) for almost all £, is it true that P is divisible by m in E( Q) ? 

By the Chinese remainder theorem, it is sufficient to restrict to the case when m = p l is a prime power. 
The answer is positive if m is prime. The explicit example in m shows that the answer is negative for 
m = 4. In m, it is shown that the answer is positive for all m = p 2 with p a prime larger than 3. To 
our knowledge, the case m = 9 has not been determined. 

This question connects to our cohomology groups through the following reinterpretation. Suppose 
m = p l for our fixed prime p. Let £ be a finite set of places in Q. Let 

D{E/Q) = ker(£(Q)/p l £(Q) E(Q v )/p l E(Q v )) 

be the group that measures if there are points P that are locally divisible by p l , but not globally 
L{E/Q) = L{G l )=ker[H 1 (G u E[p 1 ]) —> [] if 1 (C, £[?/])) 

C^Gi 
C cyclic 
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be the kernel of reduction to all the cyclic subgroups of Gi. We now assume that E contains all places 
above p and all bad places. By Chebotarev’s theorem, L(E/ Q) is also the kernel of localization from 
H 1 (Gi, E[p 1 ]) to all H 1 (D W ^ V , E[p 1 )) where D w \ v is the decomposition group in Ki/Q of a place w above 
v. Hence a natural notation for L(E/ Q) could be IH 1 ([/, E\p l \) with U the complement of E in Spec(Z). 
The sequence 

0- ^D{E/ Q)- *L(E/Q) -*- H 1 (Gi, E{K i )') 

is exact. Hence the answer is positive for m = p l if H 1 (Gi, E[p l f) vanishes. Note that the description 
of L(E/ Q) in (JT]) is now entirely group-theoretic, and can be computed numerically with the methods 
described in the previous section. 

Theorem 24. Let p a prime and i ^ 1. Then the Grunwald-Wang problem for local-global divisibility by 
m = p l admits a positive answer for all elliptic curves E /Q if and only if p > 3 or m = 2 or m = 3. 


Proof. If we find a point P of infinite order that is a counter-example for m = p\ then p° P is a counter¬ 
example for to = p l+J for any j > 0 . As mentioned before, the negative answer for to = 4 is explained 
in m • This settles also all higher powers of 2 as their examples are points of infinite order. Counter¬ 
examples when to is a power of 3 were first found by Creutz in [7j. We will give below in Proposition 1251 
a new counter-example of infinite order for to = 9. For p S? 5 the theorem follows from [20] . However, 
we wish to give a slightly simplified proof with our methods. 

Assume therefore p ^ 5. We will now show that the kernel of localization L(Gi) is zero. Note that by 
Greenberg’s result in Theorem [21] and the work done in the exceptional cases in Lemma[22]and Lemma l23l 
we may assume that G,; is greatest possible or that i = 2 and M 2 consists of all matrices to such that 
to — 1 is upper triangular. In both cases the elements in E[p l ] fixed by M,; are just E[p\. We get an exact 
sequence 

0--F :1 (G, E\pj)-^H 1 {G i ,E\p i }) -- H 1 (M it E\p >]). 

First assume that L{Gi) contains a non-trivial element which belongs to the image of the inflation map 
from H l (fG,E\p\). Since the latter must now be non-trivial, G must contain the element h = (J{). 
By the description of Mi, we find that Gi contains the element h = (J ])• Let G be the cyclic group 
generated by h and let G be its image in G. Our computations for proving Theorem [T] showed that 
7L 1 (G, E[p\) —> 7L 1 (G, E[p\) is a bijection. Next, both maps in the composition 

H 1 (G, E[p]) - ^H 1 (G, E\p l ] CnMi ) - ^H 1 (G, Etf]) 

are injective: for the latter it is because any inflation map is injective, and for the first it can be 
read off the long exact sequence associated to the inclusion E[p] —> E[p l ) cnMi . We conclude that 
p[ l (G,E[p\) —> IL 1 (G, E[p l \) is injective. This now contradicts the assumption that L{Gi) contained a 
non-trivial element from H 1 (G, E\p\). 

Therefore, L(Gi) injects into to 

L{Mi)=Yex(H\Mi,E\p i }) ^ [] H 1 (C, E[p 1 ])), 

C^Mi 

cyclic 


where the product now runs over all cyclic subgroups of AT;. We will now prove by induction on i that 
L(Mi) is trivial. It is known for i = 1. 

Recall that the group Hi acts trivially on E[p l ). We consider the following diagram with exact rows: 
0- s- H 1 (M i , E\p 1 ]) -£[?/])- -F 1 (#;,.%']) (8) 


0 —— ^Y[ c H l (c,E\p 1 ]) — -n cH^CnH^Etf}) 
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where the products run over all cyclic subgroups C of Now the vertical map on the right hand 

side has the same kernel as 


JT 1 (Hi, £?[?<]) = Hom(H i ,E\p i ]) 


II Horn {D,Etf\) 

D^Hi 

cyclic 


and this map is clearly injective. Since C H Hi fixes E[p l ] the vertical map on the right in the above 
diagram 0 is injective by induction hypothesis because C/C D Hi = CHi/Hi will run through all cyclic 
subgroups of Mi at least once. Therefore the middle vertical map in (0 is injective, too. 

Next, consider the following diagram with exact rows: 

0- *~E\p] —Hom(M j+ 1 ,£7[p]) h 1 Eft]) 

E[p i+1 ] c E[p z } c — -► Hom(C, E\p}) -- H 1 (C, E[p i+1 }) -^ H 1 (C, E\p z }) 

Here C is any cyclic subgroup of Mj + i. The zero at the top left corner is a consequence from the fact 
that the AT,; + j-fixed points in E/p 3 } are exactly E\p\ for all 1 ^ j ^ i + 1. 

If £ £ L(Mi- |_i), then its image under [p] in H 1 (Mj+i, E[p 1 ]) must be trivial by what we have shown for 
the middle vertical map in 0. Therefore £ is the image under i of an element / in Hom(Mj_|_i, E\p ]). Since 
E[p\ is p-torsion, we can identify Hom(Afj + i, E\p\) with Hom(M 2 , E\p\). To say that £ restricts to zero 
for a cyclic group C ^ M i+ 1 forces /: M 2 —> E[p) to be in the image of the map Sc ■ E[p] —> Hom(C, E\p\) 
for all cyclic subgroups C of M 2 . 

Now we identify M 2 with the additive subgroup M 2 ^ Mat 2 (F p ) as before. Under this identification 
the map S sends a p-torsion point T £ E[p\ = F p to the map / sending a matrix m £ M 2 to to(T). 
Thus, the restriction of / to Hom((m), F p ) is in the image of 8( m ) for a particular m £ M 2 if and only if 
f(m) £ F p belongs to the image of m. Therefore, we have shown that 

{/ £ Hom(M 2 ,Fp) f(m) £ im(m) Vm £ M 2 \ 

L(Mi+i ) = 1 -7-i(9) 

|/(to) = m(T) for some T £ F^j 

We wish to show that L(A/ + i) is trivial if M 2 is the full matrix group or the upper triangular matrices. 
Assume first that M 2 is the full matrix group. Then / is determined by its image on the matrices with 
only one non-zero entry. However, the local condition of being in the image of Sc for these matrices 
and the matrices (jjj) and (§ j) forces /(to) to be just m(T) for T = /((J §)) + /((§ ?))■ Therefore 
L(M i+ i) is trivial. The case when M 2 is the group of upper triangular matrices is very similar. □ 

The result about the vanishing of L(G 2 ) for p > 3 in the above proof is reminiscent of Proposition 3.2.ii 
in HI . We have reproved part of this result with a more conceptual approach. The main reason for doing 
so is that the general statement there is slightly incorrect. The case dim(A / / 2 ) = 3 assumes that (J}) 
belongs to G 2 . However, for p = 3, the group C 2 generated by (3 f) and the group of all matrices to 
with to — 1 upper-triangular is a counterexample. This group does not contain any elements of order 9 
and one can compute that L{G 2 ) is isomorphic to Z/3. 

We include here a new counter-example for m = 9; the method is quite different from [7; where a first 
such example was found. 

Proposition 25. Let E be the elliptic curve labeled 243a2, given by the global minimal equation y 2 + y = 
x 3 + 20, and let P = (—2,3). Then 3P is divisible by 9 in E(Qg) for all primes t 3, but it is not 
divisible by 9 in E( Q). 


Proof. Since P is a generator of the free part of this curve of rank 1, it is clear that 3 P is not divisible 
by 9 in E( Q). 
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Let k be the unique subfield of Q(/xg) of degree 3 over Q and let £ be a primitive 9-th root of unity. 
Then P' = (3 £ 5 + 3 £ 4 + 3,9 £ 4 — 9 £ 2 + 9C + 4) G E(k) satisfies 3 P' = P. Thus, if £ = ±1 (mod 9), then £ 
splits in k and hence P is divisible by 3 in F(Q<>). As a consequence, 3 P is divisible by 9 over Q^. 

For this curve and p = 3, the group G = (J *) is of order 6 and K = Q(0) with 6 & + 3 = 0. Factoring 
the 9-division polynomial, one finds that K 2 /K is an extension of degree 3. The field of definition of the 
points of order 9 is K 2 except for those points T with 3 T £ P(Q)[3j. Those are defined instead over a 
non-Galois extension of degree 3 over k. 

Let £ ^ ±1 (mod 9) and £ ^ 3. Then the Frobenius element Fry in G 2 cannot belong to Gal(K 2 /k). 
Therefore Fr^ does not fix any point of order 9. It follows that P(F^)[9] = A(F^)[3]. Consider the following 
commutative diagram, whose lower row is exact. 

[3i 

P G E{Q)/3E(Q) E(Q)/9E{Q) 

£(Q<)[9] —^ £(Q/)[3] E{Q t )/3E(Q t ) —^ E(Q e )/9E(Q e ) 

Since £ ^ 3, the reduction of E at £ is good and hence [3] is an isomorphism on the kernel of reduction 
E(Qg) —*■ E(¥e). It follows that S(Q^)[3] = P(Ff)[3] and E(Qt)/3E(Qg) = E(¥t)/3E(¥g) have the same 
size. By the above argument S is an injective map between two groups of the same size. Thus 5 is a 
bijection. This implies that 3 P is divisible by 9 in E(Qe). □ 

This is the counter-example of smallest conductor for m = 9; here is how we found that this curve is 
a likely candidate. 

Consider curves E with a 3-isogeny where either the kernel has a rational 3-torsion point or where 
the kernel of the dual isogeny has a rational 3-torsion point. On the one hand, we computed (for a few 
thousand primes £ ^ 3 of good reduction) the pairs (ae(E),£) modulo 9. On the other hand, we may 
determine all subgroups G 2 ^ GL 2 (Z/ 9 ) with surjective determinant to find the examples for which the 
kernel 0 is non-trivial. There are 13 such groups. The dimension of M 2 in these cases is 1, 2 or 3. For 
each of them we may list pairs (tr(g), det(c/)) when g runs through all matrices g £ G 2 . 

Now, if the list of possible pairs (ae(E),£) modulo 9 agrees with one of the lists above, then G 2 could 
be among the groups for which the localization kernel is non-trivial. Furthermore, it is easy to check 
local divisibility for primes £ < 1000 for all possible candidates in 3E(Q)/9E(Q). The above curve 243a2 
was the first to pass all these tests. 

Here are a few more candidates. Note that we have not formally proved that local divisibility holds 
by 9 holds for all primes £ of good reduction. 

The point P = (6,17) on the curve 9747fl gives a point 3 P which is likely to be locally divisible by 9 
for all primes, but not divisible by 9 globally. In this example G 2 has 54 elements. 

On the curve 972d2 the point 3 P with P = (13,35) is likely to be locally divisible by 9 for all places 
£ ^ 3, yet not globally so. This is a curve without a rational 3-torsion point and G 2 having 54 elements 
again. 

All the above examples have complex multiplication by the maximal order in Q(\/—3). The curve 
722al, with a point P having ^-coordinate 2 [gg 4 , is an example without complex multiplication and 
|< 772 1 = 162. Again, it is likely that 3P is locally divisible by 9 at all places £ ^ 19, but 3P is not globally 
divisible by 9. The group G 2 here is probably conjugate to the one mentioned earlier as a counter-example 
to Proposition 3.2.ii in [Sj. 

We have also done numerical calculation of the kernel in 0 for other primes. For p = 5, there are 
only three subgroups G 2 in GL2(Z/25) with non-trivial localization kernel. They all have dim(M 2 ) = 2 
and |G| =4. 

For p = 2, there are twelve cases. The dimensions of M 2 can be 1, 2, or 3. In only one of these cases 
is the localization kernel is Z/2 ® Z/2; otherwise it is Z/2. 
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